PBC Library Manual 0.5.11 - Stanford Crypto Group

Chapter 5. Param functions
Generate type A1 pairing parameters and store them in p. The group order will be n. The order of the base field
is a few bits longer. To be secure, generic discrete log algorithms must be infeasible in groups of order n, and
finite field discrete log algorithms must be infeasible in finite fields of order roughly n 2 . Additionally, n should
be hard to factorize.
For example: n a product of two primes, each at least 512 bits.
The file param/a1.param contains sample parameters for a type A1 pairing, but it is only for benchmarking:
it is useless without the factorization of n, the order of the group.
void pbc_param_init_d_gen(pbc_param_t p, pbc_cm_t cm)
Type D curves are generated using the complex multiplication (CM) method. This function sets p to a type D
pairing parameters from CM parameters cm. Other library calls search for appropriate CM parameters and the
results can be passed to this function.
To be secure, generic discrete log algorithms must be infeasible in groups of order r, and finite field discrete log
algorithms must be infeasible in finite fields of order q 6 . For usual CM parameters, r is a few bits smaller than q.
Using type D pairings allows elements of group G1 to be quite short, typically 170-bits. Because of a certain
trick, elements of group G2 need only be 3 times longer, that is, about 510 bits rather than 6 times long. They
are not quite as short as type F pairings, but much faster.
I sometimes refer to a type D curve as a triplet of numbers: the discriminant, the number of bits in the prime q,
and the number of bits in the prime r. The gen/listmnt program prints these numbers.
Among the bundled type D curve parameters are the curves 9563-201-181, 62003-159-158 and
496659-224-224 which have shortened names param/d201.param, param/d159.param and
param/d225.param respectively.
See gen/listmnt.c and gen/gendparam.c for how to generate type D pairing parameters.
void pbc_param_init_e_gen(pbc_param_t p, int rbits, int qbits)
Generate type E pairing parameters and store them in p, where the group order r is rbits long, and the order of
the base field q is qbits long. To be secure, generic discrete log algorithms must be infeasible in groups of order
r, and finite field discrete log algorithms must be infeasible in finite fields of order q, e.g. rbits = 160, qbits =
1024.
This pairing is just a curiosity: it can be implemented entirely in a field of prime order, that is, only arithmetic
modulo a prime is needed and there is never a need to extend a field.
26